First configuration

User Interface

• Access to your UI/APP
• Register a node

• Create a ruleset for suricata

  • Create a ruleset source
  • Create a local ruleset
  • Apply ruleset to a node or group of nodes

Analyzer

• Enable Analyzer

Suricata

• Configure Suricata

Zeek

• Configure Zeek as standalone

Wazuh

• Configure Wazuh to read the OwlH Analyzer output alerts.json file